---
title: [OR] [P2] [S3] [ITo] [C13] Monitoring, Metrics, and Continuous Improvement
description: [OR] [P2] [S3] [ITo] [C13] Monitoring, Metrics, and Continuous Improvement
image: https://blog.bcm-institute.org/hubfs/OR%20Setting%20Impact%20Tolerances%20P2%20Morepost/%5BOR%5D%20%5BP2%5D%20%5BS3%5D%20%5BITo%5D%20%5BC13%5D%20Monitoring%2c%20Metrics%2c%20and%20Continuous%20Improvement.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Setting Impact Tolerances: A Practical Guide for Operational Resilience Implementation
# \[OR\] \[P2\] \[S3\] \[ITo\] \[C13\] Monitoring, Metrics, and Continuous Improvement
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
Impact tolerance is not a one-time definition—it is a **dynamic capability that must be continuously monitored, measured, and refined**. As organisations evolve, so do their services, technologies, dependencies, customer expectations, and risk environments. Without ongoing monitoring, even well-defined tolerances can quickly become outdated or misaligned with reality.
To remain effective, organisations must establish a structured approach to **metrics, monitoring, and continuous improvement**, ensuring that impact tolerances remain relevant, achievable, and aligned with both operational capability and regulatory expectations.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5fad794-08a2-4f8b-ba94-5d32e15ba9bc)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 8, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/00e8044a-8a62-4f8f-be7c-9c267d8b3dfc)
### \[P2\] \[S3\] Chapter 13
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
### **Monitoring, Metrics, and Continuous Improvement**
#### **Introduction**
[![\[OR\] \[P2\] \[S3\] \[ITo\] \[C13\] Monitoring, Metrics, and Continuous Improvement](https://no-cache.hubspot.com/cta/default/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21)
Impact tolerance is not a one-time definition—it is a **dynamic capability that must be continuously monitored, measured, and refined**. As organisations evolve, so do their services, technologies, dependencies, customer expectations, and risk environments.
Without ongoing monitoring, even well-defined tolerances can quickly become outdated or misaligned with reality.
To remain effective, organisations must establish a structured approach to **metrics, monitoring, and continuous improvement**, ensuring that impact tolerances remain relevant, achievable, and aligned with both operational capability and regulatory expectations.
#### **Purpose of the Chapter**
The purpose of this chapter is to:
- Define key metrics used to monitor impact tolerance
- Establish Key Risk Indicators (KRIs) linked to tolerance thresholds
- Implement continuous monitoring mechanisms
- Enable feedback loops for continuous improvement
- Ensure impact tolerances remain relevant over time
#### **Key Metrics for Monitoring Impact Tolerance**
Effective monitoring begins with clearly defined and measurable metrics.
##### **Service Availability**
Service availability is a fundamental indicator of resilience.
**Key Measures:**
- Percentage uptime of CBS
- Duration of service outages
- Frequency of disruptions
**Example:**
| CBS | Target Availability | Actual Performance |
| --- | --- | --- |
| Deposit Services | 99.9% | 99.7% |
| Payment Services | 99.95% | 99.8% |
##### **Recovery Performance vs Tolerance**
This measures how well the organisation performs relative to defined impact tolerances.
**Key Measures:**
- Actual recovery time vs **MTD (Maximum Tolerable Downtime)**
- Actual data loss vs **MTDL (Maximum Tolerable Data Loss)**
- Time taken to restore the minimum service capacity
**Example**
| CBS | Defined MTD | Actual Recovery Time | Result |
| --- | --- | --- | --- |
| Deposit Services | 4 hours | 3.5 hours | Within tolerance |
| Payment Services | 2 hours | 2.5 hours | Breach |
| Digital Banking | 3 hours | 2 hours | Within tolerance |
##### **Capacity and Throughput Metrics**
- Percentage of normal transaction capacity maintained
- Volume of processed vs failed transactions
- Backlog accumulation and clearance time
##### **Customer Impact Metrics**
- Number of customers affected
- Customer complaints and escalation rates
- Service response times
#### **Key Risk Indicators (KRIs)**
KRIs provide early warning signals that tolerance thresholds may be at risk.
##### **Characteristics of Effective KRIs**
KRIs should be:
- **Forward-looking** (predict potential issues)
- **Measurable and quantifiable**
- **Linked to impact tolerance thresholds**
- **Actionable with defined triggers**
##### **Example KRIs**
| KRI | Threshold | Action Trigger |
| --- | --- | --- |
| System uptime degradation | < 98% | Investigate and escalate |
| Transaction backlog growth | > 20% increase | Activate mitigation measures |
| Third-party service latency | > 30% above baseline | Engage the vendor and monitor |
| Incident frequency | > 3 major incidents/month | Review root causes |
| Staff availability | < 80% critical roles filled | Activate contingency staffing |
##### **Linking KRIs to Impact Tolerance**
KRIs should signal:
- **Approaching tolerance limits**
- **Increased likelihood of disruption**
- **Potential cascading failures**
**Key Principle**
KRIs enable organisations to act **before tolerance is breached**, not after
#### **Continuous Monitoring Mechanisms**
Monitoring must be supported by systems and processes that provide **real-time or near real-time visibility**.
##### **Monitoring Tools and Systems**
- System performance dashboards
- Application monitoring tools
- Network and infrastructure monitoring
- Third-party service monitoring platforms
- Incident management systems
##### **Operational Monitoring**
Operational teams should monitor:
- Service performance against thresholds
- System health and alerts
- Transaction flows and backlog
- Customer service indicators
##### **Management Reporting**
Regular reporting should include:
| Reporting Level | Focus |
| --- | --- |
| Operational | Daily/real-time performance metrics |
| Management | Weekly/monthly performance trends |
| Senior Management / Board | Strategic overview, breaches, and risks |
##### **Early Warning Systems**
Organisations should implement alerts for:
- Approaching tolerance thresholds
- System degradation
- Third-party failures
- Increased incident frequency
#### **Feedback Loops and Lessons Learned**
Continuous improvement relies on structured feedback mechanisms.
##### **Sources of Feedback**
| Source | Insight Provided |
| --- | --- |
| Incident Reports | Actual disruption impact and response effectiveness |
| Scenario Testing | Performance under simulated stress conditions |
| Customer Feedback | Perceived service quality and pain points |
| Audit Findings | Governance and control weaknesses |
| Regulatory Feedback | Compliance gaps and expectations |
| Operational Metrics | Trends and performance deviations |
##### **Lessons Learned Process**
A structured approach should include:
- **Capture**
- **Analyse**
- **Evaluate**
- **Improve**
- **Update**
**Example**
| Event | Lesson Learned | Improvement Action |
| --- | --- | --- |
| Payment outage | Recovery time exceeded tolerance | Upgrade failover systems |
| Cyber incident | Detection delay | Enhance monitoring tools |
| Third-party failure | Lack of backup vendor | Establish an alternate provider |
#### **Continuous Improvement Framework**
Impact tolerance should evolve through a structured improvement cycle.
##### **Improvement Cycle**
1. Define impact tolerance
2. Monitor performance
3. Detect deviations
4. Analyse root causes
5. Implement improvements
6. Reassess tolerance
##### **Key Drivers of Change**
- Technology upgrades or failures
- Changes in customer behaviour
- New regulatory requirements
- Emerging risks (e.g., cyber threats, supply chain disruptions)
- Organisational changes (e.g., mergers, outsourcing)
#### **Integration with Operational Resilience Lifecycle**
Monitoring and continuous improvement support all stages of the lifecycle:
| Lifecycle Stage | Role of Monitoring |
| --- | --- |
| Plan | Define metrics and KRIs |
| Implement | Monitor performance against tolerance |
| Test | Validate through scenario testing |
| Improve | Refine tolerances and capabilities |
#### **Common Challenges**
| Challenge | Description |
| --- | --- |
| Inadequate metrics | Lack of meaningful or measurable indicators |
| Data fragmentation | Inconsistent data across systems |
| Delayed reporting | Lack of real-time visibility |
| Reactive approach | Acting only after incidents occur |
| Weak feedback loops | Lessons not translated into improvements |
#### **Best Practices**
- Define **clear, measurable metrics aligned with impact tolerance**
- Implement **real-time monitoring and alerting systems**
- Use KRIs to provide **early warning signals**
- Establish **structured feedback and lessons learned processes**
- Integrate monitoring into **governance and reporting frameworks**
- Regularly review and update metrics and tolerances
- Foster a culture of **continuous improvement**
#### [![Banner \[Summing\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5)
Monitoring, metrics, and continuous improvement are essential to ensuring that impact tolerances remain relevant and effective in a changing environment. By establishing clear performance indicators, implementing robust monitoring systems, and embedding structured feedback loops, organisations can maintain visibility over their resilience capabilities and respond proactively to emerging risks.
Continuous improvement transforms impact tolerance from a static threshold into a **living capability**, enabling organisations to adapt, strengthen, and sustain resilience over time. Ultimately, this ensures that critical business services can be delivered consistently within acceptable limits, even in the face of evolving disruptions.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/05996af2-38e1-4f05-96c6-6f5d6469c9de)
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** |
| --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C1\] Introduction to Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C2\] Regulatory and Standards Landscape](https://no-cache.hubspot.com/cta/default/3893111/04df8f17-629c-458f-af01-67e3da528b63.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/04df8f17-629c-458f-af01-67e3da528b63) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C3\] Understanding Impact Tolerance in Context](https://no-cache.hubspot.com/cta/default/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C4\] Linking Impact Tolerance to Critical Business Services (CBS)](https://no-cache.hubspot.com/cta/default/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C5\] Key Components of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C6\] Methodology for Setting Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12 ** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C7\] Impact Tolerance Assessment Framework](https://no-cache.hubspot.com/cta/default/3893111/abf28462-aba4-4970-81be-55cf66dc6147.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/abf28462-aba4-4970-81be-55cf66dc6147) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C8\] Scenario-Based Calibration of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C9\] Role of Dependency Mapping in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C10\] Governance, Ownership, and Accountability](https://no-cache.hubspot.com/cta/default/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C11\] Integration with Operational Resilience Framework](https://no-cache.hubspot.com/cta/default/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C12\] Testing and Validation of Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae) |
| **C13** | **C14** | **C15** | **C16** | **C17** | **C18** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C13\] Monitoring, Metrics, and Continuous Improvement](https://no-cache.hubspot.com/cta/default/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C14\] Common Challenges and Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/8831463d-a357-4203-806b-fb31ef71d615.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8831463d-a357-4203-806b-fb31ef71d615) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C15\] Practical Case Study (Banking Sector Example)](https://no-cache.hubspot.com/cta/default/3893111/fef15761-14c6-4e2b-b157-554cceb33d14.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fef15761-14c6-4e2b-b157-554cceb33d14) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C16\] Future Trends in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/b6a701db-167e-4630-88ad-de0d43deb322.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b6a701db-167e-4630-88ad-de0d43deb322) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C17\] Key Takeaways and Call to Action](https://no-cache.hubspot.com/cta/default/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C18\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/3623335d-0b26-4ee7-afbf-0d431358b390.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3623335d-0b26-4ee7-afbf-0d431358b390) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-11T07:40:46.661Z",
"datePublished" : "2026-05-08T09:58:33.000Z",
"headline" : "[OR] [P2] [S3] [ITo] [C13] Monitoring, Metrics, and Continuous Improvement",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-p2-s3-ito-c13-monitoring-metrics-and-continuous-improvement",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```